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In the literature, strong coin tossing protocols based on bit commitment have been proposed. Here 
we examine a protocol that instead tries to achieve the task by sharing entanglement securely. The 
protocol uses only qubits, and has bias j. This is equal to the best known bias for bit commitment 
based schemes. 



■ I. INTRODUCTION 

o ■ 

O ■ n 

' Alice and Bob, having recently divorced, want to decide who keeps the car m. Both now live separate lives on 

_ , opposite sides of the country, and to meet in person would be inconvenient and traumatic. A coin tossing protocol 
' seeks to provide a sequence of information exchanges that allow the decision to be fairly made. Whether or not this 
I , is possible depends on the physical properties of the systems used for information exchange. Protocols which cannot 
satisfy the full requirements demanded of coin tossing are given a figure of merit depending on the maximum cheating 
probability they allow. 

. Coin tossing comes in two flavours, weak and strong. A weak coin tossing protocol suffices if the parties know which 
J> ' outcome the other prefers. This is the case in the divorcees example above, where both Alice and Bob would like to 
keep the car. Suppose outcome means Alice keeps the car, and 1 means Bob does. A protocol need not protect 
' against Alice biasing towards 1, nor Bob towards 0, and hence a weak coin toss protocol can be used. In contrast, a 
, strong coin tossing protocol is needed when it is not known which outcome the other party prefers. 

o\ 

O 
O 



Previous Results 



Coin tossing was introduced by Blum 1] in 1981. There, a variant of our task was discussed in a classical setting 
using computational assumptions to give security. However, in a classical setting where unconditional security^ is 
" pH ,. sought, no protocol can offer any protection against a cheat H. That quantum coin tossing protocols offer some 
advantage over classical ones was realized by Aharonov et al. [3|, who introduced a protocol achieving a bias of 

^ ■ [3, 01 . For strong coin tossing, it has been shown by Kitaev that in any protocol, at least one party can achieve a 
'[ bias greater than — \ is not known whether this figure represents an achievable bias. The best known bias 

_ ^ ■ to date (which is realized via a qutrit-based bit commitment scheme) is |; Q and this is optimal for a large set of 
I protocols [3]. For weak coin tossing, Kitaev's bound is known not to apply and lower biases than \ have been 

^ \ achieved (see for example 8] for the best bias to date). Moreover, Ambainis has shown that a protocol with bias 
e > must have a number of rounds that grows as (log log i) 

In this paper, we consider only non-relativistic protocols (in which communications between parties can be effectively 
taken to be instantaneous). It is known that using two separated sites and exploiting the impossibility of superluminal 
signalling, ideal coin tossing can be implemented with perfect security Q. 



B. Definitions 



In a coin tossing protocol, two separated and mistrustful parties, Alice and Bob, wish to generate a shared random 
bit. We consider a model in which they do not initially share any resources, but have access to trusted laboratories 
containing trusted error-free apparatus for creating and manipulating quantum states. In general, a protocol for this 
task may be defined to include one or more security parameters, which we denote Ni, . . . , N^. 



* r.a.colbeck®damtp.cam.ac .uk| 

^ i.e., security based only in a belief in the laws of physics 
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If both parties are honest, a coin tossing protocol guarantees that they are returned the same outcome, b G {0, 1} 
where outcome b occurs with probabihty ^ + Cb(^ij ■ ■ ■ , ^r), or "abort" which occurs with probabihty C2(^i7 • ■ • , Nr), 
where for each j e {0, 1, 2}, Cj(^ij • ■ ■ j ^r) ^ as the Ni — > oo. The bias of the protocol towards party P G {A, B} 
is denoted ep = max (ep, ep), where P can deviate from the protocol in such a way as to convince the other (honest) 
party that the outcome is b with probability at most ^ + ep + 6p{Ni, . . . ,Nr), where the Sp{Ni, . . . , Nr) ^ as the 
Ni ^ oo. We make no requirements of the protocol in the case where both parties cheat. 

The bias of the protocol is defined to be ma,x{eA, £b)- A protocol is said to be balanced if £^4 = e^' ^'^^ b — and 
6=1. 

We define the following types of coin tossing: 

Ideal Coin Tossing: A coin tossing protocol is ideal if it has eA = £b = 0, that is, no matter what one party 
does to try to bias the outcome, their probability of successfully doing so is strictly zero. It is then said to be perfectly 
secure if for some finite values of A^i, . . . , Nr, the quantities Cji^ii • ■ • i ^r) and Sp{Ni, . . . , Nr) are strictly zero, and 
otherwise is said to be secure. 

Strong Coin Tossing: A strong coin tossing protocol is parameterized by a bias, 7. The protocol has the 
property that ep < 7 for all P £ {A, B} and b G {0, 1}, with equality for some P, b. 

Weak Coin Tossing: A weak coin tossing protocol is also parameterized by a bias, 7. It has the property that 
^'a — 1 — 7' with equality in one of the two inequalities. 

In the next section we give a new protocol for strong coin tossing and show that it is balanced and has bias j. 

II. THE PROTOCOL 

1. Alice creates 2 copies of the state — --i=(|00) + |11)) and sends the second qubit of each to Bob. 

2. Bob randomly selects one of the states to be used for the coin toss. He informs Alice of his choice. 

3. Alice and Bob measure their halves of the chosen state in the {|0) , |1)} basis to generate the result of the coin 
toss. 

4. Alice sends her half of the other state to Bob who tests whether it is the state it should be by measuring the 
projection onto \tp). If his test fails, Bob aborts. 

A. Alice's Bias 

Assume Bob is honest. We will determine the maximum probability that Alice can achieve outcome 0, pa (an 
analogous result follows by symmetry for the case that Alice wants to bias towards 1). Alice's most general strategy 
is as follows. She can create a state in an arbitrarily large Hilbert space, 1^") G Ha ^ Hai ^ Ti-Ai ^ ^B2j 

where Ha represents the space of an ancillary system Alice keeps, Hbi and Hb2 are qubit spaces sent to Bob in the 
first step of the protocol, and Hai and Ha2 are qubit spaces, one of which will be sent to Bob for verification. On 
receiving Bob's choice of state in step [21 Alice can do one of two local operations on the states in her possession, 
before sending Bob the relevant qubit for verification. Alice should choose her state and local operations so as to 
maximize the probability that Bob obtains outcome and does not detect her cheating. 

Let us denote the state of the entire system by 

I*) = aoo |0oo)aAiA2 |00)biB2 + ^01 IMaa.a^ \^'^)b^B2 + «io I</'io)aAiA2 |10)biB2 + IMaa^a^ Ill)i3ii32 ' (1) 

where il't'ij) AAiA2^'-':i normalized states in Alice's possession, and {aij}ij are coefficients. Suppose Bob announces 
that he will use the first state for the coin toss. There is nothing Alice can subsequently do to affect the probability 
of Bob measuring on the qubit in Hbi ■ We can assume that Bob makes the measurement on this qubit immediately 
on making his choice. Let us also assume that Alice discovers the outcome of this measurement so that she knows 
the pure state of the entire system (we could add a step in the protocol where Bob tells her, for example^). If Bob 



^ Such a step can only make it easier for Alice to cheat, so security under this weakened protocol implies security under the original one. 
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gets outcome 1, then Alice cannot win. On the other hand, if Bob gets outcome 0, the state of the remaining system 
becomes 

/ n \MaA^A^ |0>i32 + / 2°°^ 2 |0Oi)aAiA2 Il)i32 ' (2) 

Vaoo + «oi Vaoo+«oi 

and Ahce can win if she can pass Bob's test in the final step of the protocol. Since entanglement cannot be increased by 
local operations, the system Alice sends to Bob in this case can be no more entangled than this state. Alice therefore 
cannot fool Bob into thinking she was honest with probability greater than i°oo+aoi j _ Using a similar argument for 
the case that Bob chooses the second state for the coin toss shows that Alice's overall success probability is at most 
\ (2aQQ + 2aooaoi + 2aooaio + a^i + Oio)- Maximizing this subject to the normalization condition gives a maximum 
of |, hence we have the bound pa < f ■ Equality is achievable within the original protocol (i.e., without the additional 
step we introduced) by having Alice use the state 

Vl 10000)^^^^^^^^ + i= (10011)^^5^^^^^ + \imMB,A^,B:) , (3) 

and simply sending TLai or 'Ha2 to Bob in the final step, depending on Bob's choice. 

The protocol is cheat-sensitive towards Alice — any strategy which increases her probability of obtaining one outcome 
gives her a non-zero probability of being detected. 

B. Bob's Bias 

Assume Alice is honest. We will determine the maximum probability that Bob can achieve the outcome 0, pb- The 
maximum probability for outcome 1 follows by symmetry. Bob seeks to take the qubits he receives, perform some 
local operation on them, and then announce one of them to be the coin-toss state such that the probability that Alice 
measures on her part of the state he announces is maximized. 

Suppose that we have found the local operation maximizing Bob's probability of convincing Alice that the outcome 
is 0. Having performed this operation and sent the announcement to Alice, the outcome probabilities for Alice's 
subsequent measurement on the state selected by Bob in the {|0) , |1)} basis are fixed. Bob's probability of winning 
depends only on this. It is therefore unaffected by anything Alice does to the other qubit, and, in particular, 
is unaffected if Alice measures both of her qubits in the {|0) , |1)} basis before looking at Bob's choice. Such a 
measurement commutes with Bob's local operation, so could be done by Alice prior to Bob's operation without 
changing any outcome probabilities. If Alice does this measurement she gets outcome 1 on both qubits with probability 
■|. In such a case. Bob cannot convince Alice that the outcome is 0. Therefore, we have bounded Bob's maximum 
probability of winning via < |. 

To achieve equality. Bob can measure each qubit he receives in the {|0) , |1)} basis, and if he gets one with outcome 
0, choose this state as the one to use for the coin toss. There is no cheat sensitivity towards Bob; he can use this 
strategy without fear of being caught. 

III. DISCUSSION 

We have introduced a new protocol for strong coin tossing which achieves a bias of -j. Whilst this bias is not an 
improvement over existing protocols, our protocol uses a conceptually different approach to previous ones. Rather 
than being built on bit-commitment, the protocol works by attempting to share entanglement between two parties, 
and then exploiting the resulting quantum correlations to implement a coin toss. This provides a further illustration 
of the power of entanglement as a resource. Furthermore, our protocol requires only qubits for its implementation, 
whereas bit-commitment based protocols cannot achieve such a bias without using higher dimensional systems [7|. 

Additional Notes: The protocol we present is a special case of a protocol for random bit string generation found 
in where only one bit is sought^. However, the security analysis in does not extend to the single bit case. 
We have also learned that this protocol was independently discovered by Louis Salvail [ll| whose work on this was 
not published. 



^ We thank the anonymous referee for pointing this out. 
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